Do you have any tips for helping the business understand when data becomes more of a liability than an asset of real value? Is the current regulatory landscape making this harder or easier to determine, from your experience?

Businesses need to recognize that data can quickly become a liability when it’s outdated or improperly managed. Clear communication about the risks—like compliance costs and potential breaches—can help. Interestingly, the current regulatory landscape is pushing us to reevaluate data value, making it easier to identify when it becomes more of a burden than a benefit.

Yes, I think you have to express in numbers how much is the cost of having that data. I believe is a good parameter that allows the business a better understanding of the situation. Here at the SBS, we have some regulatory that indicates us how long we must have the data. After that period, is a decision of the business if we want to maintain that data longer.

If there isn't a business reason to retain certain data, it should not be kept, as it then becomes a liability. This isn't just a broad liability but also an expensive one. Some AI projects can be funded simply by identifying and eliminating old or stale data. The current regulatory landscape mandates that businesses know what data they possess and comply with relevant regulations. These rules vary depending on the jurisdictions in which the business operates, which means compliance and privacy officers are crucial in managing this aspect.

Sometimes, contractual requirements may necessitate retaining data for longer periods. Reflecting on my experience at Experian, where we faced numerous lawsuits and class actions, we had a forensic team dedicated solely to discovery responses. The data we retained never served to protect the company; instead, it often resulted in harm. Therefore, it is beneficial to delete data as soon as possible, as this reduces liability and shrinks the attack surface, making it harder for data to be stolen. However, it is essential to understand the relevant regulations and contractual obligations. This understanding will guide the development of retention schedules, which should be consistently applied across the organization. In one instance, inconsistency in data retention practices among business units led to legal complications. Maintaining consistency in data retention policies is crucial.